{"vulnerability": "cve-2026-4227", "sightings": [{"uuid": "81dbb1cb-92b8-4ce3-a8fb-43195939c821", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4227", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116238743317716735", "content": "", "creation_timestamp": "2026-03-16T12:01:05.653961Z"}, {"uuid": "1793b9a8-2382-485c-b150-abd07c7ec459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-4227", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhk4bi22lq2a", "content": "", "creation_timestamp": "2026-03-21T03:40:09.644524Z"}, {"uuid": "1b13b61b-48f1-4108-a0d2-63eb6e898cae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42274", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlcvppit5j2k", "content": "CVE-2026-42274 - Heimdall: Authorization bypass via path normalization mismatch\nCVE ID : CVE-2026-42274\n \n Published : May 8, 2026, 3:43 a.m. | 42\u00a0minutes ago\n \n Description : Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version...", "creation_timestamp": "2026-05-08T04:34:59.566181Z"}, {"uuid": "924e7b08-ba89-4066-9449-e77cae13f75c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlcvztlzbz2q", "content": "CVE-2026-42271 - LiteLLM: Authenticated command execution via MCP stdio test endpoints\nCVE ID : CVE-2026-42271\n \n Published : May 8, 2026, 3:35 a.m. | 50\u00a0minutes ago\n \n Description : LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From ver...", "creation_timestamp": "2026-05-08T04:40:39.065435Z"}, {"uuid": "a2447c19-9299-4c17-8816-715ad152704f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42272", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlcw5olsko2e", "content": "CVE-2026-42272 - Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation\nCVE ID : CVE-2026-42272\n \n Published : May 8, 2026, 3:40 a.m. | 45\u00a0minutes ago\n \n Description : Heimdall is a cloud native Identity Aware Proxy and Access Con...", "creation_timestamp": "2026-05-08T04:42:47.862379Z"}, {"uuid": "5123c8df-e500-466d-945e-e6f56915cd9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42273", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlcwl7ndjp2c", "content": "CVE-2026-42273 - Heimdall: Case-sensitive host matching may lead to policy bypass\nCVE ID : CVE-2026-42273\n \n Published : May 8, 2026, 3:42 a.m. | 43\u00a0minutes ago\n \n Description : Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versi...", "creation_timestamp": "2026-05-08T04:50:21.865175Z"}, {"uuid": "5eb19a95-0b3c-4b7d-a2d4-88d5d37e732c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42275", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlcxnwb3t42i", "content": "CVE-2026-42275 - zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write\nCVE ID : CVE-2026-42275\n \n Published : May 8, 2026, 3:45 a.m. | 40\u00a0minutes ago\n \n Description : zrok is software for sharing web services, files, and network res...", "creation_timestamp": "2026-05-08T05:09:46.647301Z"}, {"uuid": "4dd9217d-c62d-4f84-bb20-aaa26dd5553c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42278", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mld4vebsjp2e", "content": "CVE-2026-42278 - UltraDAG: Smart Account Spending Policy Bypass via Pockets\nCVE ID : CVE-2026-42278\n \n Published : May 8, 2026, 5:16 a.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngin...", "creation_timestamp": "2026-05-08T06:43:27.979739Z"}, {"uuid": "44aaf2ed-a713-41b2-ac03-3d03d62f67af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42275", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlgtkuisrr2w", "content": "\ud83d\udccc CVE-2026-42275 - zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend (davServer.Dir) restric... https://www.cyberhub.blog/cves/CVE-2026-42275", "creation_timestamp": "2026-05-09T18:07:07.858922Z"}, {"uuid": "63eaf7ce-047a-45fc-b04c-7fdd7e3e70b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42275", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlhkmz3vov2g", "content": "\ud83d\udfe0 CVE-2026-42275 - High (8.7)\n\nzrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-42275/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-10T00:59:57.236758Z"}, {"uuid": "7f03d412-bae6-47ba-b907-646635370b95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlhknapjpo2t", "content": "\ud83d\udfe0 CVE-2026-42271 - High (8.8)\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From versio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-42271/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-10T01:00:04.170298Z"}, {"uuid": "23fbda2e-a350-4fb0-ad71-81a89ab906a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "published-proof-of-concept", "source": "Telegram/zNPCcRZLVUnG7MzXxuguKud9BYCf7Gj51sr3J84x37QbILk", "content": "", "creation_timestamp": "2026-05-20T09:00:05.000000Z"}, {"uuid": "974e787c-acf7-4bd3-9a0e-2dff2c6fe6a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-42271.yaml", "content": "", "creation_timestamp": "2026-06-02T16:26:11.000000Z"}, {"uuid": "7b0d03c1-432f-4e20-8c99-2c8cb6873d50", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/fc2749e6-b097-4d27-bc2f-6df29375da7f", "content": "", "creation_timestamp": "2026-06-08T18:00:02.189789Z"}, {"uuid": "7fa90335-09ea-4145-bcf5-6b647c245bf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://infosec.exchange/users/secdb/statuses/116716025409567659", "content": "\ud83d\udea8 [CISA-2026:0608] CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0608)\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.\n\u26a0\ufe0f CVE-2026-42271 (https://secdb.nttzen.cloud/cve/detail/CVE-2026-42271)- Name: BerriAI LiteLLM Command Injection Vulnerability- Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.- Known To Be Used in Ransomware Campaigns? Unknown- Vendor: BerriAI- Product: LiteLLM- Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g ; https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable ; https://nvd.nist.gov/vuln/detail/CVE-2026-42271\n#ZEN #SecDB #InfoSec #CVE #CISA_KEV #cisa_20260608 #cisa20260608 #cve_2026_42271 #cve202642271", "creation_timestamp": "2026-06-08T22:07:55.641928Z"}, {"uuid": "40f55f1d-0668-401a-9995-711351b63034", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mnswgbpvs62y", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u60272\u4ef6\u3092\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds Two Known Exploited Vulnerabilities to Catalog  #CISA (Jun 8)\n\nCVE-2026-42271 BerriAI LiteLLM \u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\nCVE-2026-50751 Check Point Security Gateway\u306e\u8a8d\u8a3c\u30a8\u30e9\u30fc\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-06-09T00:20:35.502416Z"}, {"uuid": "c33acd58-58a6-43bc-ae95-e54165225c1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mntbbdknr62b", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-42271 BerriAI LiteLLM Command\u2026\n\n\ud83d\udd17 https://hnow.live/a/2d12cf75", "creation_timestamp": "2026-06-09T03:34:40.905155Z"}, {"uuid": "17db7c0b-b361-402a-98d0-0d52d0b60476", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mntlrrnwqf2z", "content": "LiteLLM\u306b\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027(CVE-2026-42271)\u304c\u3042\u308a\u3001\u8a8d\u8a3c\u6e08\u307f\u30e6\u30fc\u30b6\u30fc\u304c\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u53ef\u80fd\u3002", "creation_timestamp": "2026-06-09T06:42:51.084357Z"}, {"uuid": "e79864ee-b721-4909-a274-be35c21351fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mntluirkgp2d", "content": "CISA added CVE-2026-42271 in LiteLLM to KEV due to active exploitation, where command injection lets authenticated users run arbitrary host commands.\n", "creation_timestamp": "2026-06-09T06:44:23.673665Z"}, {"uuid": "17b61eb3-0cfa-4987-a11c-6f1a3ed03494", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mntlyw6gat2q", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE", "creation_timestamp": "2026-06-09T06:46:50.247638Z"}, {"uuid": "acfd36cf-4a38-4920-999d-beb0f557475d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mntmaxkmut2s", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "creation_timestamp": "2026-06-09T06:51:19.504412Z"}, {"uuid": "4bb4a5d9-dc8a-452c-b94a-5055ab2537b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mntmkjgbmtj2", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting Berr...\n\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-09T06:56:42.578056Z"}, {"uuid": "b09c229b-caca-4393-9230-76a4fe04387c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mntmmbxhbc25", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\n\nthehackernews.com/2026/06/lite...\n\n#Cybersecurity #LargeScaleImpact #Vulnerability", "creation_timestamp": "2026-06-09T06:57:40.619335Z"}, {"uuid": "4405fb68-5c96-4163-a347-9aa4c4a411f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.\n\nThe vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the", "creation_timestamp": "2026-06-09T04:26:14.000000Z"}, {"uuid": "10fb91e1-0500-4497-a030-69eb4297bb8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mntmyjvgrz2r", "content": "LiteLLM CVE-2026-42271: CISA Confirms Active Exploitation of CVSS 10.0 RCE Chain", "creation_timestamp": "2026-06-09T07:04:30.451344Z"}, {"uuid": "a5732943-9cab-4ccb-b28a-fd966c102f6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mntmzfur7sg2", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE TheHackerNews CISA added CVE-2026-42271, a high-severity LiteLLM command injection flaw, to its KEV catalog after ev...\n\n#Security #News\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-09T07:05:07.498526Z"}, {"uuid": "1cf8c9e4-1156-4260-ac15-ca8f058264bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mntn56ibea2r", "content": "\u26a0\ufe0f La faille CVE-2026-42271 dans LiteLLM (#BerriAI) permet l'ex\u00e9cution de commandes \u00e0 distance sans authentification. CISA confirme son exploitation active. #CyberSecurity #IA  \n", "creation_timestamp": "2026-06-09T07:07:07.657927Z"}, {"uuid": "b8730909-99fa-4f17-b961-732659db2fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/cybersecurity0001.bsky.social/post/3mntohdbk2b26", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE", "creation_timestamp": "2026-06-09T07:30:40.951130Z"}, {"uuid": "c099807a-2963-4f65-851b-8e0b402fa67f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mntq5lc76t2n", "content": "\ud83d\udea8 [CRITICAL INFRASTRUCTURE ALERT]: CVE-2026-42271\n\n\u2022 CVE ID: CVE-2026-42271\n\u2022 CVSS Score: 8.8 (High)\n\u2022 Affected: Wild\n\u2022 \u26a0\ufe0f CISA KEV\n\nhttps://securitycyber.uk", "creation_timestamp": "2026-06-09T08:01:00.518281Z"}, {"uuid": "f465dfe5-e7d2-4e21-8a3c-888bf4091631", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/blindthoughts.bsky.social/post/3mntr27qqlo2n", "content": "LiteLLM CVE-2026-42271: Unauthenticated RCE Exploited in the Wild, Now on CISA KEV\n\nhttps://blindthoughts.com/litellm-cve-2026-42271-unauthenticated-rce-cisa-kev\n\n#vulnerability #rce #aiinfrastructure #cisakev #litellm", "creation_timestamp": "2026-06-09T08:17:01.523792Z"}, {"uuid": "cfe30da5-9e5d-468d-849c-5514bbe01ca2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/it4intserver.bsky.social/post/3mntuqpq6gx2h", "content": "iT4iNT SERVER LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE VDS VPS Cloud #Cybersecurity #Vulnerability #CVE202642271 #RCE #InfoSec", "creation_timestamp": "2026-06-09T09:23:21.210307Z"}, {"uuid": "72756f57-dae3-44b4-976c-1079c4bb8768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/techsentiments.com/post/3mntwkbp6jy2d", "content": "\u26a1 LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\n\n#Cybersecurity #Security", "creation_timestamp": "2026-06-09T09:55:29.379621Z"}, {"uuid": "09a3e687-c191-4c76-8688-772ab7be1816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/sec-news-bot.bsky.social/post/3mntwuolze72a", "content": "LiteLLM \u306e CVE-2026-42271 \u304c\u91ce\u751f\u3067\u60aa\u7528\u3001\u672a\u8a8d\u8a3cRCE\u306b\u9023\u9396\n\nCISA \u306f LiteLLM \u306e\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027 CVE-2026-42271\uff08\u9ad8\u6df1\u523b\u5ea6\uff09\u3092 KEV \u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3002\u65e2\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u3066\u304a\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067 RCE \u304c\u53ef\u80fd\u3002LiteLLM \u30e6\u30fc\u30b6\u30fc\u306f\u76f4\u3061\u306b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u3066\u304f\u3060\u3055\u3044\u3002\n\n#CVE #\u8106\u5f31\u6027 #\u60c5\u5831\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "creation_timestamp": "2026-06-09T10:01:19.715277Z"}, {"uuid": "6d8a948f-4282-42af-aca2-262ce39e9f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mntwx7jrr42z", "content": "\ud83d\udd12 LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity ...\n\nhttps://tinyurl.com/2334as8r #CyberSecurity #InfoSec #CrustyTLDR", "creation_timestamp": "2026-06-09T10:03:00.759453Z"}, {"uuid": "0a601d8e-dd29-4fd2-82d2-d2a529103c33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/vritrasecnews.bsky.social/post/3mntzm3e56v27", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citin...\n\n\ud83d\udd17 https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "creation_timestamp": "2026-06-09T10:50:10.835566Z"}, {"uuid": "a12825a6-a9bb-4396-9078-e079f9be85f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnu25zlnl62h", "content": "CISA has added CVE-2026-42271 to its KEV catalog after active exploitation. The LiteLLM command injection flaw can chain with a Starlette auth bypass to enable unauthenticated RCE. #LiteLLM #CVE-2026-42271 #CVE-2026-48710", "creation_timestamp": "2026-06-09T11:00:13.857117Z"}, {"uuid": "1b327841-a02a-4f58-ad91-d4d7f6ee6e48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/securestep9.bsky.social/post/3mnu2srgd3c2e", "content": "#LiteLLM command injection vulnerability CVE-2026-42271 that could allow any authenticated user to run arbitrary commands on the host, has been added to the CISA KEV catalog:\n\ud83d\udc47\nthehackernews.com/2026/06/lite...", "creation_timestamp": "2026-06-09T11:11:49.342163Z"}, {"uuid": "560dbd7c-5ed2-4a35-9840-f430a416afd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mnu4mdbhss2o", "content": "LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/06/09/l...\n\n#cybersecurity #cybersecuritynews #AI #LLMs #opensource #proxy #vulnerability", "creation_timestamp": "2026-06-09T11:44:04.206128Z"}, {"uuid": "bd86812f-4533-4212-83b0-7c96b44ed717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mnu7zg2r5k2u", "content": "LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)\n\nwww.helpnetsecurity.com/2026/06/09/l...\n\n#Cybersecurity #LargeScaleImpact #Vulnerability", "creation_timestamp": "2026-06-09T12:45:06.256418Z"}, {"uuid": "b7c3c3e0-c455-4f29-a384-36da853af46f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/aegisbot.bsky.social/post/3mnub5u7lyn2t", "content": "\ud83d\udea8 CISA KEV [CVSS 8.8 \u00b7 HIGH]\nLiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)\n\nhttps://www.helpnetsecurity.com/2026/06/09/litellm-vulnerability-under-active-attack-cisa-warns-cve-2026-42271/\n\n#CISA #KEV #PatchNow", "creation_timestamp": "2026-06-09T13:05:23.556951Z"}, {"uuid": "dd3bac4d-0071-4136-830c-b6eb5bdb03be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mnubtetqsi2x", "content": "\ud83d\udc1b VULNERABILITIES LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2014 The Hacker News\nhttps://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html #InfoSec #CyberSecurity", "creation_timestamp": "2026-06-09T13:17:25.546920Z"}, {"uuid": "b4ef7709-372c-4c5e-9c15-1a299f8d8b77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mnuc7d2veu2r", "content": "\ud83d\udc1b VULNERABILITIES LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2014 The Hacker News\nhttps://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html #InfoSec #CyberSecurity", "creation_timestamp": "2026-06-09T13:24:06.373459Z"}, {"uuid": "722b4440-1770-4cba-9263-7c1cb15e950f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mnudo42xep2l", "content": "Critical Security Advisory LiteLLM Remote Code Execution CVE-2026-42271 and CVE-2026-48710 Threat Intelligence Alert #appsec", "creation_timestamp": "2026-06-09T13:50:16.520932Z"}, {"uuid": "ed72ee3f-2a6b-4c39-984c-71a1656dd9d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mnufk67mgz2y", "content": "LiteLLM\u306e\u8106\u5f31\u6027\u304c\u7a4d\u6975\u7684\u306b\u60aa\u7528\u4e2d\u3001CISA\u304c\u8b66\u544a\uff08CVE-2026-42271\uff09\n\nBerryAI\u304c\u958b\u767a\u3059\u308b\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u306eAI\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u300cLiteLLM\u300d\u306b\u5b58\u5728\u3059\u308b\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\uff08CVE-2026-42271\uff09\u304c\u653b\u6483\u8005\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u6708\u66dc\u65e5\u3001\u3053\u306e\u6b20\u9665\u3092\u65e2\u77e5\u306e\u60aa\u7528\u6e08\u307f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3059\u308b\u3053\u3068\u3067\u3001\u305d", "creation_timestamp": "2026-06-09T14:23:51.622377Z"}, {"uuid": "286f70ec-d142-4bf5-a9b5-02f37dec03aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mnuh5fp4ls23", "content": "\u26a0\ufe0f CISA added CVE-2026-42271 to KEV: Command injection in LiteLLM gateway (1.74.2\u20131.83.7). MCP preview endpoints spawn attacker commands on the proxy host, gated only by an API key, so any authenticated user gets command execution. Patch to 1.83.7+. Query: product=\"LiteLLM API\" OR product=\"LiteLLM\"", "creation_timestamp": "2026-06-09T14:52:34.060857Z"}, {"uuid": "55d18fec-40a9-4ff6-a7a4-ec0c5f8f8367", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116720910257894126", "content": "\ud83d\udcf0 CISA Adds Actively Exploited LiteLLM and Check Point Flaws to KEV Catalog\n\ud83d\udce2 CISA adds two actively exploited flaws to its KEV list! A command injection in LiteLLM (CVE-2026-42271) and an auth bypass in Check Point VPNs (CVE-2026-50751). Federal agencies must patch now. All orgs should prioritize! #CyberSecurity #Vulnerabi...\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-exploited-litellm-and-checkpoint-flaws-to-kev-catalog/?utm_source=m\u2026", "creation_timestamp": "2026-06-09T15:42:29.658653Z"}, {"uuid": "2e4ef0de-fbf6-4d15-8b06-bca56492b149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mnujxkde2l2b", "content": "\ud83d\udce2 CISA adds two actively exploited flaws to its KEV list! A command injection in LiteLLM (CVE-2026-42271) and an auth bypass in Check Point VPNs (CVE-2026-50751). Federal agencies must patch now. All orgs should prioritize! #CyberSecurity #Vulnerabi...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-06-09T15:42:56.221071Z"}, {"uuid": "4839c44c-21df-4ec2-aab1-d67365f089b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/apemanor.bsky.social/post/3mnukyjrs5l2y", "content": "\ud83d\udcf0 LiteLLM Flaw CVE-2026-42271 Exploited in the Wild: Unauthenticated RCE Risks Heighten\n\nhttps://apemanor.com/article/7fff5335-32d5-488d-ab1a-f4423d69fc04\n\n#Tech #News #Discussion", "creation_timestamp": "2026-06-09T16:01:23.007008Z"}, {"uuid": "ab997c3b-a32b-44a6-9be3-76a5d40b6b8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/breachandbuild.bsky.social/post/3mnumabzgv32g", "content": "\ud83d\udea8 New threat alert! We're breaking down CVE-2026-42271, actively exploited in the wild. This LiteLLM flaw allows unauthenticated RCE on vulnerable AI proxy...\n\n#CyberSecurity #BreachAndBuild #LiteLLM #CVE202642271 #CommandInjection\n\nhttps://breachandbuild.com/cve-2026-42271-litellm-rce-actively/", "creation_timestamp": "2026-06-09T16:23:36.349344Z"}, {"uuid": "0116f55a-619c-47a4-8cb7-d4706fba6be9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mnv6wpomiu2j", "content": "CISA\u304cLiteLLM\u306e\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u653b\u6483\u304c\u6d3b\u767a\u306b\u884c\u308f\u308c\u3066\u3044\u308b\u3068\u8b66\u544a\uff08CVE-2026-42271\uff09 \n\nLiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)  #HelpNetSecurity (Jun 9)\n\nwww.helpnetsecurity.com/2026/06/09/l...", "creation_timestamp": "2026-06-09T21:58:16.694967Z"}, {"uuid": "2a1194c8-f1a5-4b80-a913-129ad5331daf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mnvpt2vf4t2m", "content": "\ud83d\udc1b VULNERABILITIES LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2014 The Hacker News\nhttps://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html #InfoSec #CyberSecurity", "creation_timestamp": "2026-06-10T03:00:27.557725Z"}, {"uuid": "d0556d10-bbf2-4ce0-b44a-bfe79e97c654", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mnvqkbrpj22h", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\n\nThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evide\u2026\n#hackernews #llm #news", "creation_timestamp": "2026-06-10T03:13:26.802422Z"}, {"uuid": "27f8e9a5-2e69-4eef-8628-e36a72316851", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/termsofsurrender.bsky.social/post/3mnvr5irfou2b", "content": "LiteLLM Exploit Hits the Wild While Prague Files It Under Later\nPANIC 86% | Lag 20.7h | CVE-2026-42271 is being exploited in the wild and can chain to unauthenticated remote code execution\n#AfterShockIndex\nREAD MORE", "creation_timestamp": "2026-06-10T03:24:11.385794Z"}, {"uuid": "1b7cfa7f-fdbb-49de-b015-c8b8298372c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mnvuiwpqkv2b", "content": "LiteLLM Zero-Day Chain Attack: The CVSS 100 AI Gateway Catastrophe +\u00a0Video\n\nIntroduction: A critical command injection vulnerability in the LiteLLM AI gateway (CVE-2026-42271) is actively being exploited in the wild, allowing any authenticated user to run arbitrary commands on the server. The risk\u2026", "creation_timestamp": "2026-06-10T04:24:16.788386Z"}, {"uuid": "a6ae50ed-29c0-467a-b00c-3d2e9b57e1a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mnw66u3pnq2u", "content": "CVE watch: LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated...\n\nCheck exposure, dependency, and agent/tool access before panic-patching. Inventory beats vibes.\n\nSource: thehackernews.com\nhttps://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "creation_timestamp": "2026-06-10T07:18:08.692671Z"}, {"uuid": "580b0f04-4a90-4127-beca-adc5071ff036", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mnw6x4ijcc2h", "content": "LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)\n\nA command injection vulnerability (CVE-2026-42271) in BerryAI\u2019s LiteLLM open-source AI gateway is being exploited by attackers, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed b\u2026\n#hackernews #llm #openai", "creation_timestamp": "2026-06-10T07:31:10.046087Z"}, {"uuid": "e949d339-b4cb-4942-9f96-c8f4142e8d96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/ins-aisolutions.bsky.social/post/3mnwfjdxo2j2e", "content": "A reminder this week that the AI stack has single points of failure: CISA flagged an actively exploited LiteLLM flaw (CVE-2026-42271) in its KEV catalog. A respected tool -- and proof any one component can fail. We built LLM Counsel on the opposite instinct: more than one model in the room. #AI #LLM", "creation_timestamp": "2026-06-10T09:28:44.513272Z"}, {"uuid": "1908e8ab-7f87-409b-a066-a971fd91598f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mnwo7edztm2j", "content": "TSUITE INTEL: Critical vulnerability CVE-2026-42271 hits LiteLLM enterprise routing and n8n pipelines. Active CISA KEV exploitation verified. Deploy this forensic playbook for immediate environment sandboxing and egress security controls. Read at https://thecybermind.co/3jgn", "creation_timestamp": "2026-06-10T12:04:12.902141Z"}, {"uuid": "f7b5a22a-0366-46ec-a50d-2040032a9d5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/ins-aisolutions.bsky.social/post/3mnzcx5k6pe2f", "content": "A reminder from this week's news for anyone building on AI infrastructure: a widely used LLM gateway, LiteLLM, is patching an actively exploited remote-code-execution flaw (CVE-2026-42271), now on CISA's known-exploited list. No schadenfreude here -- every team running this layer should patch and", "creation_timestamp": "2026-06-11T13:20:44.869392Z"}, {"uuid": "d496f796-cb31-40a4-abed-df8ac92b489e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mo24ebkqd42m", "content": "CVE-2026-42271 enables unauthenticated remote code execution in LiteLLM via command injection, requiring rapid federal patching by June 22.\n", "creation_timestamp": "2026-06-11T20:55:29.248179Z"}, {"uuid": "62c77b78-368c-4458-8b31-6fa88d142786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-42271", "type": "seen", "source": "https://bsky.app/profile/iberianm.bsky.social/post/3mo727krbma26", "content": "LiteLLM (CVE-2026-42271) is in CISA KEV for active exploitation. Patch immediately, restrict access so no untrusted users can reach the service, and monitor command injec\u2026 #Cybersecurity #Vulnerability #ThreatIntel\n\nSource: https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "creation_timestamp": "2026-06-13T20:00:49.113781Z"}, {"uuid": "5840d3ab-4b0a-4be2-a4d9-85893bfc0449", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "MISP/d511a704-eba2-411a-9543-41e0e130f522", "content": "", "creation_timestamp": "2026-06-15T17:02:26.000000Z"}, {"uuid": "40578aae-b7fe-4ca4-a08d-db7cd8df2bb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/patrickcmiller.bsky.social/post/3moigwteso32i", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE thehackernews.com/2026/06/lite...", "creation_timestamp": "2026-06-17T13:42:06.612636Z"}, {"uuid": "bc4cbddb-3273-4a41-bd29-c83d4f9c8058", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/apemanor.bsky.social/post/3momuthz6re2e", "content": "\ud83d\udcf0 LiteLLM CVE-2026-42271: Essential Steps to Mitigate RCE Vulnerability\n\nhttps://apemanor.com/article/fc300c82-26ca-42a8-9a26-86f1a0cdbec7\n\n#Tech #News #Discussion", "creation_timestamp": "2026-06-19T08:01:24.115652Z"}, {"uuid": "0033a566-8561-458d-9769-deea611bc73c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "published-proof-of-concept", "source": "Telegram/zS0m-Smw9tMC2xQZhVRiFtrXmVStzlksgIyfU5bMHDdEXnY", "content": "", "creation_timestamp": "2026-06-09T15:00:06.000000Z"}, {"uuid": "a489ccd6-ddd1-4943-bcb9-f15bc9156c1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "Telegram/cRfqgLJAFIkFCvcAZKUAB7pj3UpVza-RsLFCIp3hG_l99w", "content": "", "creation_timestamp": "2026-06-09T12:09:35.000000Z"}, {"uuid": "e40ce4a9-9ea5-4d09-a9e2-d7b2f8f21a16", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2dffeba4-d318-4ca1-82b1-e5c5157901a4", "content": "", "creation_timestamp": "2026-06-19T12:45:07.902172Z"}, {"uuid": "ff277af6-7ea1-4457-a632-aee2ae8c0d23", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/9a132474-34d7-4126-9585-beafa55e1c1a", "content": "", "creation_timestamp": "2026-06-23T14:03:00.210220Z"}, {"uuid": "0c25774d-99eb-4373-9f2c-45165667e543", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mp3dzpbrwc2s", "content": "Anatomie de la CVE-2026-42271 : la passerelle IA LiteLLM ex\u00e9cutait du code via le protocole MCP - IT SOCIAL itsocial.fr/cybersecurit...", "creation_timestamp": "2026-06-25T02:10:39.444967Z"}, {"uuid": "f60bf507-0163-4124-b66b-a63380d27a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpt5wb6fyc2m", "content": "CISA Adds Two Known Exploited Vulnerabilities to Catalog\nRelease Date June 08, 2026\n\nCVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability\nCVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability", "creation_timestamp": "2026-07-04T13:25:10.808707Z"}, {"uuid": "10362c78-f234-4825-b6de-d8bc725a3b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpu5f3xwss2l", "content": "\u7c73\u5f53\u5c40\u3001Check Point\u88fdUTM\u3084LiteLLM\u306e\u8106\u5f31\u6027\u60aa\u7528\u306b\u6ce8\u610f\u559a\u8d77\n\n\u7c73\u5f53\u5c40\u306f\u3001Check Point\u88fd\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4\u3084\u300cLiteLLM\u300d\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u304c\u73fe\u5730\u6642\u95932026\u5e746\u67088\u65e5\u3001\u300c\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\uff08KEV\uff09\u300d\u3078\u8106\u5f31\u60272\u4ef6\u300cCVE-2026-50751\u300d\u300cCVE-2026-42271\u300d\u3092\u8ffd\u52a0\u3057\u305f\u3002\n\n\u300cCVE-2026-50751\u300d\u306f\u3001Check Point Software Technologies\u304c\u63d0\u4f9b\u3059\u308bUTM\u88fd\u54c1\u306e\u30ea\u30e2\u30fc\u30c8VPN\u6a5f\u80fd\u306b...", "creation_timestamp": "2026-07-04T22:48:14.685577Z"}, {"uuid": "14b2a3a5-f5b2-4beb-b880-399357b50df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpu5zdgc4k2l", "content": "LiteLLM\u306e\u8106\u5f31\u6027CVE-2026-42271\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3001\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306b\u3064\u306a\u304c\u308b\u3053\u3068\u304c\u5224\u660e\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u6708\u66dc\u65e5\u3001BerriAI LiteLLM\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u6df1\u523b\u306a\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u4e8b\u4f8b\uff08KEV \uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u304c\u3042\u308b\u305f\u3081\u3060\u3002\n\nCVE-2026-42271 \uff08CVSS\u30b9\u30b3\u30a2\uff1a8.7\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027\u3067\u3042\u308a\u3001\u8a8d\u8a3c\u3055\u308c\u305f\u30e6\u30fc\u30b6\u30fc\u3067\u3042\u308c\u3070\u8ab0\u3067\u3082\u30db\u30b9\u30c8\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3067\u304d\u3066\u3057\u307e\u3046\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002", "creation_timestamp": "2026-07-04T22:59:34.354434Z"}, {"uuid": "696251df-d0fd-4e6f-8988-3893a880cc54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpu77r7lrs2l", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001BerriAI LiteLLM\u3068Check Point Security Gateway\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001  BerriAI LiteLLM\u3068Check Point Security Gateway\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3055\u308c\u305f2\u3064\u306e\u6b20\u9665\u306f\u4ee5\u4e0b\u306e\u3068\u304a\u308a\u3067\u3059\u3002\n\nCVE-2026-42271  \uff08CVSS\u30b9\u30b3\u30a2ver.4.0/8.7\uff09BerriA...", "creation_timestamp": "2026-07-04T23:21:03.670067Z"}, {"uuid": "2d1f2a2f-b826-4a87-bc66-86e7c4862f20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mpx7iq3thg2b", "content": "~Asec~\nQ2 2026 saw a 27% rise in CISA KEV listings, with ransomware-linked vulns doubling and AI stack exploits emerging via prompt injection and supply chain attacks.\n-\nIOCs: CVE-2026-42824, CVE-2026-26030, CVE-2026-42271\n-\n...", "creation_timestamp": "2026-07-06T04:04:04.339105Z"}, {"uuid": "a1ef17cb-018e-4288-9dde-81261830c448", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpy5bjtigc2z", "content": "GitHub Advisory GHSA-v4p8-mg3p-g94g / CVE-2026-42271 \u2014 LiteLLM command execution details and fixed version:\ngithub.com/advisories/G...\n\nMicrosoft Security Blog \u2014 partner ecosystem / CSP tenant downstream-customer risk:\nwww.microsoft.com/en-us/securi...", "creation_timestamp": "2026-07-06T12:56:58.187917Z"}, {"uuid": "2de09283-3208-449a-beca-2421ad9bc00a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpy5bjtqac2z", "content": "GitHub Advisory GHSA-v4p8-mg3p-g94g / CVE-2026-42271 \u2014 LiteLLM command execution details and fixed version:\ngithub.com/advisories/G...\n\nMicrosoft Security Blog \u2014 partner ecosystem / CSP tenant downstream-customer risk:\nwww.microsoft.com/en-us/securi...", "creation_timestamp": "2026-07-06T12:56:58.648572Z"}, {"uuid": "6cb2ff78-2a63-4a52-8f4a-cdc8393e5243", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpy5bjtr7k2z", "content": "GitHub Advisory GHSA-v4p8-mg3p-g94g / CVE-2026-42271 \u2014 LiteLLM command execution details and fixed version:\ngithub.com/advisories/G...\n\nMicrosoft Security Blog \u2014 partner ecosystem / CSP tenant downstream-customer risk:\nwww.microsoft.com/en-us/securi...", "creation_timestamp": "2026-07-06T12:56:59.094805Z"}, {"uuid": "614c23ac-43f5-4986-9f83-ccf5c9e4622c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/alphahunt.io/post/3mpy5bjtr7l2z", "content": "GitHub Advisory GHSA-v4p8-mg3p-g94g / CVE-2026-42271 \u2014 LiteLLM command execution details and fixed version:\ngithub.com/advisories/G...\n\nMicrosoft Security Blog \u2014 partner ecosystem / CSP tenant downstream-customer risk:\nwww.microsoft.com/en-us/securi...", "creation_timestamp": "2026-07-06T12:56:59.527963Z"}, {"uuid": "e2e199d8-3318-4af0-beb6-895397b7e751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-06)", "content": "", "creation_timestamp": "2026-07-07T10:15:06.682303Z"}, {"uuid": "304e5a57-ebe1-4237-ac1f-cd29807bb4ff", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1b26b62a-da76-499d-90ac-46ad2a554239", "content": "", "creation_timestamp": "2026-07-08T01:00:10.361072Z"}, {"uuid": "9b27229d-aa95-4390-9215-fa3f7222ff6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-07)", "content": "", "creation_timestamp": "2026-07-08T10:15:04.280541Z"}, {"uuid": "ba78ee45-9378-4b46-8758-deada221976d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-08)", "content": "", "creation_timestamp": "2026-07-09T10:15:04.126660Z"}, {"uuid": "2e6ab255-d03b-4f14-9c63-146d6256973e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-09)", "content": "", "creation_timestamp": "2026-07-10T10:15:04.931986Z"}, {"uuid": "acb9f8b6-aefd-4092-bde9-6aafe0e10ccf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-10)", "content": "", "creation_timestamp": "2026-07-11T10:15:05.098289Z"}, {"uuid": "4a5ec235-2eba-4973-9003-9a7750880a22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/ctinow/251488", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\nhttps://ift.tt/CeSoz7T", "creation_timestamp": "2026-07-12T09:01:47.928959Z"}, {"uuid": "d78f160e-d8af-4d5d-8bc4-5e0545d0cebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/TengkorakCyberCrewzz/11001", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2013 thehackernews.com\n\nTue, 09 Jun 2026 14:26:14", "creation_timestamp": "2026-07-12T09:01:47.764488Z"}, {"uuid": "c8ce9602-2345-4cd5-860f-d31b821b99a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/cibsecurity/89688", "content": "\ud83d\udd8b\ufe0f LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \ud83d\udd8b\ufe0f\n\nThe U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a highseverity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation.  The vulnerability, tracked as CVE202642271 CVSS score 8.7, is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-12T09:01:47.968057Z"}, {"uuid": "c48cd8ec-f3b9-45c5-b927-394d3cd550b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-11)", "content": "", "creation_timestamp": "2026-07-12T10:15:03.544150Z"}, {"uuid": "4e8e394e-08cd-4e43-a70f-a9f1d28d4664", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/TengkorakCyberCrewzz/11001", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2013 thehackernews.com\n\nTue, 09 Jun 2026 14:26:14", "creation_timestamp": "2026-07-13T00:00:48.254811Z"}, {"uuid": "68e01123-c3f1-4c17-8fc9-6baf4bc74629", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/ctinow/251488", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE\nhttps://ift.tt/CeSoz7T", "creation_timestamp": "2026-07-13T00:00:48.392211Z"}, {"uuid": "fcb209bf-871d-45d8-9a3d-095d3cae0c31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/cibsecurity/89688", "content": "\ud83d\udd8b\ufe0f LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \ud83d\udd8b\ufe0f\n\nThe U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a highseverity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation.  The vulnerability, tracked as CVE202642271 CVSS score 8.7, is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the.\n\n\ud83d\udcd6 Read more.\n\n\ud83d\udd17 Via \"The Hacker News\"\n\n----------\n\ud83d\udc41\ufe0f Seen on @cibsecurity", "creation_timestamp": "2026-07-13T00:00:48.420490Z"}, {"uuid": "b9e26a1e-e4e0-4bca-bd59-ddc44eb82adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-12)", "content": "", "creation_timestamp": "2026-07-13T10:15:04.492108Z"}, {"uuid": "d26bdfff-98d5-423d-8a5a-86ee7b35c7ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/eurotrends24.bsky.social/post/3mqkgduwtnj2u", "content": "Just like The Archers podcast, are you 'on target' with your cybersecurity strategy? Learn how to protect your organization from the latest threats, including CVE-2026-42271 #cybersecurity #TheArchers", "creation_timestamp": "2026-07-13T19:27:12.398523Z"}, {"uuid": "8e251320-5cfe-4648-8938-8542f0cd8923", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/GithubRedTeam/92786", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a amnsecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 05:41:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:05.797963Z"}, {"uuid": "bbaf9802-63ea-4089-9e0d-217ad311a411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/GithubRedTeam/92419", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aymanmahmoudoffsec-creator\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 23:52:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:10.245092Z"}, {"uuid": "3592f972-3a42-47c3-bc3b-e8e6076b274d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/GithubRedTeam/92786", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a amnsecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 05:41:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:09.268216Z"}, {"uuid": "3c34e637-08b0-4327-aa1e-b4b34bab0916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/GithubRedTeam/92419", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aymanmahmoudoffsec-creator\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 23:52:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:18.769988Z"}, {"uuid": "0f3b5648-8e84-4ab0-851e-f32c4db9cf10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-13)", "content": "", "creation_timestamp": "2026-07-14T10:15:09.063053Z"}, {"uuid": "a4f9d265-3850-4a65-a839-ff0be9cef7a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/bhhub/1197", "content": "Weekly 7 AI & Cyber signals to act on (Jun 6\u201315, 2026)\n\n#AISecurity@bhhub \n\n\u2728Anthropic Disables Fable 5 and Mythos 5 After US Export-Control Directive Over Jailbreak Concerns\nURL\nUS government ordered Anthropic to cut off all foreign-national access to its most capable models, Claude Fable 5 and Mythos 5, citing a jailbreak that could unlock dangerous cybersecurity capabilities \u2014 Anthropic complied within hours but publicly disputed the scope of the threat, noting the same jailbreak could elicit similar capabilities from competitor models not subject to the order.\n\n\u2728 OWASP \"State of Agentic AI Security and Governance v2.01\" \u2014 Real CVEs Replace Theoretical Threats, Coding Agents Are the Top Risk Driver\nURL\nOWASP's GenAI Security Project released v2.01 of its agentic AI security and governance report, shifting from last year's catalogue of plausible threats to one built on actual CVEs, vendor advisories, and breach reports \u2014 finding that 28 of 53 tracked agentic projects are coding agents, that prompt injection remains the dominant production failure mode, and that \"lethal trifecta\" risk combinations (private data + untrusted content + external communication) are amplified by multi-agent cascading failures.\n\n#AppSec@bhhub \n\n\u2728 Miasma Worm Hits 73 Microsoft GitHub Repos via AI Coding Agent Config Poisoning \u2014 Attack Framework Later Leaked Publicly\nURL\nA self-replicating supply-chain worm pushed malicious AI-coding-agent configuration files \u2014 a poisoned .claude/settings.json SessionStart hook plus equivalents for Cursor, Gemini CLI, and VS Code \u2014 into 73 Microsoft Azure, Azure-Samples, Microsoft, and MicrosoftDocs repositories via a compromised contributor account; opening any of the affected repos in an AI coding tool silently triggered a credential-harvesting payload. GitHub disabled all 73 repos in two automated waves within 105 seconds, but the attack framework itself was leaked publicly five days later via a \"Miasma-Open-Source-Release\" repo.\n\n\u2728 CVE-2026-42271 + CVE-2026-48710 Chain to Unauthenticated RCE in LiteLLM AI Gateway \u2014 Added to CISA KEV\nURL\nHorizon3.ai chained a LiteLLM command-injection flaw (CVE-2026-42271, CVSS 8.7, affecting the open-source AI gateway and Python SDK from BerriAI) with a Starlette \"BadHost\" header-validation bypass (CVE-2026-48710) to achieve full unauthenticated remote code execution against LiteLLM deployments; CISA confirmed active exploitation and added both CVEs to its Known Exploited Vulnerabilities catalog on June 8.\n\n#RedTeam@bhhub \n\n\u2728 MPBench: First Systematic Benchmark of Memory-Poisoning Attacks Against LLM Agents\nURL\nA new benchmark systematically evaluates memory-poisoning attacks against LLM agents that maintain persistent or long-term memory, showing that injected false memories survive across sessions and propagate into downstream task execution at high success rates, while existing memory-sanitization defenses provide only partial mitigation.\n\n\u2728 Hack The Box \"Attack of the Agents\" CTF: Autonomous AI Agent Solves 4/10 Challenges Unprompted Ahead of MCP Server GA\nURL\nHTB's internal CTF event field-testing its new Model Context Protocol (MCP) server integration saw an AI-driven agent independently join the competition and autonomously solve 4 of 10 challenges with no human direction, while a human participant with no prior cybersecurity background scored a perfect 10/10 in 38 minutes \u2014 versus the platform's historical average solve time of 4.3 hours.\n\n#Blue@bhhub \n\n\u2728 BlueVoyant Launches \"BlueVoyant AI\" Agentic SecOps Platform with Autonomous Containment Actions\nURL\nBlueVoyant launched an agentic Security Operations platform that applies ensemble models to cut alert noise and authorizes AI agents to autonomously isolate devices, revoke access tokens, and remove malicious email \u2014 with every agent action logged for audit and rollback \u2014 offered as a fully managed SOC or self-service SaaS, with deep integration across its 2,500+ existing Microsoft-centric customer deployments.", "creation_timestamp": "2026-07-14T12:00:05.218118Z"}, {"uuid": "108ea1e7-8f97-45d9-bd19-30a48f0e001c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/ytroncal.bsky.social/post/3mqmwifkuek2i", "content": "CVE-2026-42271: How a Popular AI Gateway Became an RCE Vector \u2014 And What to Audit in Your Stack  dev.to/alejandxr/cv...", "creation_timestamp": "2026-07-14T19:21:24.420893Z"}, {"uuid": "c6aea95d-8640-4e1d-ae70-b56b2fdb07dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/bhhub/1197", "content": "Weekly 7 AI & Cyber signals to act on (Jun 6\u201315, 2026)\n\n#AISecurity@bhhub \n\n\u2728Anthropic Disables Fable 5 and Mythos 5 After US Export-Control Directive Over Jailbreak Concerns\nURL\nUS government ordered Anthropic to cut off all foreign-national access to its most capable models, Claude Fable 5 and Mythos 5, citing a jailbreak that could unlock dangerous cybersecurity capabilities \u2014 Anthropic complied within hours but publicly disputed the scope of the threat, noting the same jailbreak could elicit similar capabilities from competitor models not subject to the order.\n\n\u2728 OWASP \"State of Agentic AI Security and Governance v2.01\" \u2014 Real CVEs Replace Theoretical Threats, Coding Agents Are the Top Risk Driver\nURL\nOWASP's GenAI Security Project released v2.01 of its agentic AI security and governance report, shifting from last year's catalogue of plausible threats to one built on actual CVEs, vendor advisories, and breach reports \u2014 finding that 28 of 53 tracked agentic projects are coding agents, that prompt injection remains the dominant production failure mode, and that \"lethal trifecta\" risk combinations (private data + untrusted content + external communication) are amplified by multi-agent cascading failures.\n\n#AppSec@bhhub \n\n\u2728 Miasma Worm Hits 73 Microsoft GitHub Repos via AI Coding Agent Config Poisoning \u2014 Attack Framework Later Leaked Publicly\nURL\nA self-replicating supply-chain worm pushed malicious AI-coding-agent configuration files \u2014 a poisoned .claude/settings.json SessionStart hook plus equivalents for Cursor, Gemini CLI, and VS Code \u2014 into 73 Microsoft Azure, Azure-Samples, Microsoft, and MicrosoftDocs repositories via a compromised contributor account; opening any of the affected repos in an AI coding tool silently triggered a credential-harvesting payload. GitHub disabled all 73 repos in two automated waves within 105 seconds, but the attack framework itself was leaked publicly five days later via a \"Miasma-Open-Source-Release\" repo.\n\n\u2728 CVE-2026-42271 + CVE-2026-48710 Chain to Unauthenticated RCE in LiteLLM AI Gateway \u2014 Added to CISA KEV\nURL\nHorizon3.ai chained a LiteLLM command-injection flaw (CVE-2026-42271, CVSS 8.7, affecting the open-source AI gateway and Python SDK from BerriAI) with a Starlette \"BadHost\" header-validation bypass (CVE-2026-48710) to achieve full unauthenticated remote code execution against LiteLLM deployments; CISA confirmed active exploitation and added both CVEs to its Known Exploited Vulnerabilities catalog on June 8.\n\n#RedTeam@bhhub \n\n\u2728 MPBench: First Systematic Benchmark of Memory-Poisoning Attacks Against LLM Agents\nURL\nA new benchmark systematically evaluates memory-poisoning attacks against LLM agents that maintain persistent or long-term memory, showing that injected false memories survive across sessions and propagate into downstream task execution at high success rates, while existing memory-sanitization defenses provide only partial mitigation.\n\n\u2728 Hack The Box \"Attack of the Agents\" CTF: Autonomous AI Agent Solves 4/10 Challenges Unprompted Ahead of MCP Server GA\nURL\nHTB's internal CTF event field-testing its new Model Context Protocol (MCP) server integration saw an AI-driven agent independently join the competition and autonomously solve 4 of 10 challenges with no human direction, while a human participant with no prior cybersecurity background scored a perfect 10/10 in 38 minutes \u2014 versus the platform's historical average solve time of 4.3 hours.\n\n#Blue@bhhub \n\n\u2728 BlueVoyant Launches \"BlueVoyant AI\" Agentic SecOps Platform with Autonomous Containment Actions\nURL\nBlueVoyant launched an agentic Security Operations platform that applies ensemble models to cut alert noise and authorizes AI agents to autonomously isolate devices, revoke access tokens, and remove malicious email \u2014 with every agent action logged for audit and rollback \u2014 offered as a fully managed SOC or self-service SaaS, with deep integration across its 2,500+ existing Microsoft-centric customer deployments.", "creation_timestamp": "2026-07-15T00:00:24.879899Z"}, {"uuid": "0a205bcb-e84e-40ab-b88f-b9a36f5f225e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92419", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a aymanmahmoudoffsec-creator\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-07 23:52:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:31.469268Z"}, {"uuid": "6df312b5-60d9-4204-9aba-b08056e30069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/92786", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42271-LiteLLM-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a amnsecurity\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 2  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-10 05:41:27\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:36.816245Z"}, {"uuid": "7bb83113-a28a-4932-92ac-017c568022cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-14)", "content": "", "creation_timestamp": "2026-07-15T10:15:04.205007Z"}, {"uuid": "8c7387c4-bf2e-42cf-aae4-8e0c1788aeb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/thehackernews/9184", "content": "\ud83d\udea8 Hackers are already exploiting a flaw in LiteLLM, a widely used open-source AI gateway.\n\nOne bug (CVE-2026-42271) lets any logged-in user run commands on the server. Chain it with a second bug, and attackers get in with no login at all.\n\nAt risk: API keys, stored secrets, and everything connected to it.\n\n\ud83d\udd17 Details: https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "creation_timestamp": "2026-07-15T12:00:05.156067Z"}, {"uuid": "74046475-8f06-446c-80c9-a22c9eb53111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/HackerNewscyber/3072", "content": "\u2708\ufe0f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 LiteLLM \u0628\u0627 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a\u061b \u0647\u0634\u062f\u0627\u0631 CISA \u062f\u0631\u0628\u0627\u0631\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83c\udfa5\u0633\u0627\u0632\u0645\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 (CISA) \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-42271 \u0631\u0627 \u062f\u0631 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062a\u0646\u200c\u0628\u0627\u0632 LiteLLM \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa4\u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0647 \u062f\u0627\u0631\u0627\u06cc \u0634\u062f\u062a \u0628\u0627\u0644\u0627 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0634\u062f\u0647\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0636\u0639\u0641 \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0648 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627 \u062f\u0631 \u0628\u0631\u062e\u06cc endpoint\u0647\u0627\u06cc \u062a\u0633\u062a \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0627\u062d\u0631\u0627\u0632\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0628\u062f\u0647\u062f.\n\n\ud83c\udfa5\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634\u200c\u0647\u0627\u06cc \u0641\u0646\u06cc\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0635\u0648\u0631\u062a \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0646\u0642\u0635 \u062f\u06cc\u06af\u0631\u06cc \u062f\u0631 \u0641\u0631\u06cc\u0645\u200c\u0648\u0631\u06a9 Starlette \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0646\u062c\u0631 \u0628\u0647 \u062f\u0648\u0631 \u0632\u062f\u0646 \u06a9\u0627\u0645\u0644 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0639\u062a\u0628\u0631 \u0634\u0648\u062f.\n\n\ud83c\udfa4\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0632\u0646\u062c\u06cc\u0631\u0647 \u062d\u0645\u0644\u0647 \u0628\u0627\u0644\u0642\u0648\u0647 \u0627\u0645\u06a9\u0627\u0646 \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc API \u0648 \u06af\u0633\u062a\u0631\u0634 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc \u0645\u062a\u0635\u0644 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u2708\ufe0f@HackerNewsCyber", "creation_timestamp": "2026-07-15T13:00:05.173401Z"}, {"uuid": "048e99ea-754b-4fe9-b6b4-7c45bdfebe24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/HackerNewscyber/3072", "content": "\u2708\ufe0f \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 LiteLLM \u0628\u0627 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0641\u0639\u0627\u0644 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a\u061b \u0647\u0634\u062f\u0627\u0631 CISA \u062f\u0631\u0628\u0627\u0631\u0647 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631\n\n\ud83c\udfa5\u0633\u0627\u0632\u0645\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a \u0633\u0627\u06cc\u0628\u0631\u06cc \u0648 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u0622\u0645\u0631\u06cc\u06a9\u0627 (CISA) \u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-42271 \u0631\u0627 \u062f\u0631 \u067e\u0644\u062a\u0641\u0631\u0645 \u0645\u062a\u0646\u200c\u0628\u0627\u0632 LiteLLM \u0628\u0647 \u0641\u0647\u0631\u0633\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc\u200c\u0647\u0627\u06cc \u062f\u0631 \u062d\u0627\u0644 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\n\ud83c\udfa4\u0627\u06cc\u0646 \u0646\u0642\u0635 \u0627\u0645\u0646\u06cc\u062a\u06cc \u06a9\u0647 \u062f\u0627\u0631\u0627\u06cc \u0634\u062f\u062a \u0628\u0627\u0644\u0627 \u0627\u0631\u0632\u06cc\u0627\u0628\u06cc \u0634\u062f\u0647\u060c \u0646\u0627\u0634\u06cc \u0627\u0632 \u0636\u0639\u0641 \u062f\u0631 \u06a9\u0646\u062a\u0631\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0648 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627 \u062f\u0631 \u0628\u0631\u062e\u06cc endpoint\u0647\u0627\u06cc \u062a\u0633\u062a \u0627\u0633\u062a \u0648 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u06a9\u0627\u0631\u0628\u0631\u0627\u0646 \u0627\u062d\u0631\u0627\u0632\u0634\u062f\u0647 \u0627\u062c\u0627\u0632\u0647 \u0627\u062c\u0631\u0627\u06cc \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 \u0631\u0627 \u0628\u062f\u0647\u062f.\n\n\ud83c\udfa5\u0628\u0631 \u0627\u0633\u0627\u0633 \u06af\u0632\u0627\u0631\u0634\u200c\u0647\u0627\u06cc \u0641\u0646\u06cc\u060c \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0635\u0648\u0631\u062a \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 \u0646\u0642\u0635 \u062f\u06cc\u06af\u0631\u06cc \u062f\u0631 \u0641\u0631\u06cc\u0645\u200c\u0648\u0631\u06a9 Starlette \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0645\u0646\u062c\u0631 \u0628\u0647 \u062f\u0648\u0631 \u0632\u062f\u0646 \u06a9\u0627\u0645\u0644 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0648 \u0627\u062c\u0631\u0627\u06cc \u06a9\u062f \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u062f\u0633\u062a\u0631\u0633\u06cc \u0645\u0639\u062a\u0628\u0631 \u0634\u0648\u062f.\n\n\ud83c\udfa4\u06a9\u0627\u0631\u0634\u0646\u0627\u0633\u0627\u0646 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0647\u0634\u062f\u0627\u0631 \u062f\u0627\u062f\u0647\u200c\u0627\u0646\u062f \u0627\u06cc\u0646 \u0632\u0646\u062c\u06cc\u0631\u0647 \u062d\u0645\u0644\u0647 \u0628\u0627\u0644\u0642\u0648\u0647 \u0627\u0645\u06a9\u0627\u0646 \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633\u060c \u06a9\u0644\u06cc\u062f\u0647\u0627\u06cc API \u0648 \u06af\u0633\u062a\u0631\u0634 \u062f\u0633\u062a\u0631\u0633\u06cc \u0628\u0647 \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u200c\u0647\u0627\u06cc \u0645\u062a\u0635\u0644 \u0631\u0627 \u0641\u0631\u0627\u0647\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f.\n\n\u2708\ufe0f@HackerNewsCyber", "creation_timestamp": "2026-07-16T00:00:10.920313Z"}, {"uuid": "e7386748-bd03-4ec4-87b0-af5d244ccf3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/thehackernews/9184", "content": "\ud83d\udea8 Hackers are already exploiting a flaw in LiteLLM, a widely used open-source AI gateway.\n\nOne bug (CVE-2026-42271) lets any logged-in user run commands on the server. Chain it with a second bug, and attackers get in with no login at all.\n\nAt risk: API keys, stored secrets, and everything connected to it.\n\n\ud83d\udd17 Details: https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html", "creation_timestamp": "2026-07-16T00:00:09.844380Z"}, {"uuid": "f800206e-4955-49c5-92e8-175356eb8c72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-15)", "content": "", "creation_timestamp": "2026-07-16T10:15:04.519381Z"}, {"uuid": "156d325a-02e2-476e-b92e-4b20d86d9c15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-16T19:00:17.578864Z"}, {"uuid": "625ffa85-9110-4c06-8ed8-dcc8924ab9d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-17T00:00:33.256682Z"}, {"uuid": "f43f9fd0-cf1b-42fe-9d96-03c8930e52e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-16)", "content": "", "creation_timestamp": "2026-07-17T10:15:04.637427Z"}, {"uuid": "bf50d9b4-cd6b-42f0-9308-eb71b1a1d667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "published-proof-of-concept", "source": "Telegram/MCIVjT2wGlOhNzGxxI4_zyvBHRQPD_Tsyc6A30C1dkLHGvM", "content": "", "creation_timestamp": "2026-07-18T00:00:33.260448Z"}, {"uuid": "894b1b5d-544b-4170-a51f-f1a5415900c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-17)", "content": "", "creation_timestamp": "2026-07-18T10:15:06.862476Z"}, {"uuid": "7deefb39-0582-49ba-a34d-15664ab6cfb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-07-18)", "content": "", "creation_timestamp": "2026-07-19T10:00:06.521011Z"}, {"uuid": "b8f26b12-9b76-4133-ace7-95e9885cb77f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-18)", "content": "", "creation_timestamp": "2026-07-19T10:15:04.242278Z"}, {"uuid": "faed9a5d-9518-4b5c-85a4-71568acc7876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://t.me/MalaysiaHacktivistz/22185", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2013 thehackernews.com\n\nTue, 09 Jun 2026 14:26:14", "creation_timestamp": "2026-07-19T16:00:04.251322Z"}, {"uuid": "0910066c-d418-4536-8725-0710803a4493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "https://t.me/MalaysiaHacktivistz/22185", "content": "LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE \u2013 thehackernews.com\n\nTue, 09 Jun 2026 14:26:14", "creation_timestamp": "2026-07-20T00:00:22.952725Z"}, {"uuid": "a142550f-8eb7-426e-bc46-61f9a1c43dd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-19)", "content": "", "creation_timestamp": "2026-07-20T10:15:03.890683Z"}, {"uuid": "efc854fc-39aa-4767-bedc-fa96b574221d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-20)", "content": "", "creation_timestamp": "2026-07-21T10:15:50.641347Z"}, {"uuid": "0c13402f-f348-498d-9a66-c5febdf0a805", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-22)", "content": "", "creation_timestamp": "2026-07-23T10:15:04.723840Z"}]}